What is the CVSS score of CVE-2026-10888?

CVE-2026-10888 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10888?

A critical remote code execution vulnerability in Google Chrome's Cast Streaming component affects any user running versions prior to 149.0.7827.53 on shared network segments.. A patch is available.

How to fix or mitigate CVE-2026-10888?

Within 24 hours: Inventory active Chrome versions across your endpoint management platform and identify deployment scope on corporate/shared networks. Within 7 days: Deploy Chrome 149.0.7827.53 or later via your standard patch management process; prioritize client devices on internal network segments. Within 30 days: Verify 100% patch compliance and document remediation status.

Google Chrome CVE-2026-10888

EUVD-2026-34551 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-x4hq-xrc2-5r23

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:23 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Cast Streaming in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome's Cast Streaming component (versions prior to 149.0.7827.53) allows an attacker on the same local network segment to execute arbitrary code by sending malicious network traffic to a vulnerable browser. The flaw is rated Critical by the Chromium project and carries a CVSS 3.1 score of 8.8, with no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in Cast Streaming, the Chromium subsystem responsible for sender/receiver media streaming to Chromecast and other Cast-compatible receivers, which typically operates over the local network using protocols such as mDNS-based discovery and the Cast/RTP streaming pipeline. The root cause is a CWE-416 Use-After-Free condition, in which an object is referenced after its backing memory has been released, enabling an attacker who controls the freed allocation to corrupt browser memory and hijack execution flow. Because Cast Streaming code runs in a renderer or utility process with parsing of attacker-controlled network data, a malformed Cast streaming message can reach the vulnerable code path without the user explicitly initiating a casting session.

RemediationAI

Apply the vendor-released patch by updating Google Chrome to version 149.0.7827.53 or later via the stable channel auto-updater or by forcing an update through chrome://settings/help, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium issue tracker entry https://issues.chromium.org/issues/505815080. Users of Chromium-derived browsers should install the equivalent rebased build from their respective vendors as soon as it is published. If patching must be delayed, compensating controls include keeping Chrome users off untrusted networks (public Wi-Fi, conference, hotel) via VPN-only egress, disabling the Media Router/Cast functionality through the MediaRouterEnabled enterprise policy set to false (trade-off: users lose Chromecast/Cast-to-device capability), and segmenting guest Wi-Fi from corporate VLANs to prevent an attacker on the same broadcast domain from reaching enterprise endpoints; none of these substitute for the patch.